Domains

List, create, update, and delete domains connected to your organization.

Manage the domains connected to your organization. This is the primary supported integration surface — safe to automate against.

/api/domains

GET/api/domains

List every domain in your organization, with record counts and your effective access to each.

POST/api/domains

/api/domains/:id

GET/api/domains/:id

Fetch a single domain, including nameservers and your access level.

PATCH/api/domains/:id

Update primary status, alias target, or catch-all routing for the domain.

DELETE/api/domains/:id

Delete a domain and its DNS zone, cleaning up delegation records in the parent zone. Fails with has_subzones while child subzones exist.

/api/domains/:id/verify

GET/api/domains/:id/verify

Run the full health check — registrar delegation, per-nameserver probes, ownership TXT token, mail readiness, DNSSEC chain — without persisting anything.

POST/api/domains/:id/verify

Run the same check and persist the delegation status transition (pending → active and back).

curl -X POST https://avura.work/api/domains \
  -H "Authorization: Bearer avk_5f2c1e9a..." \
  -H "Content-Type: application/json" \
  -d '{"name": "example.com"}'

/api/domains/:id/subzones

GET/api/domains/:id/subzones

List the direct child subzones of a domain. Requires editor access to the parent.

POST/api/domains/:id/subzones

Delegate a subdomain into its own DNS zone. Body: {"label": "dev"}. Requires manager access to the parent.

A subzone is a full domain in its own right: it carries parentDomainId pointing at the domain it was delegated from, and delegation NS records are added to the parent zone automatically. Subzones nest to arbitrary depth — a subzone can spawn its own subzones the same way (access resolution walks up to 16 levels of ancestry). Pin an API token to any node in the tree to hand out credentials isolated to that subtree. The label may span multiple levels (dev or customer.dev); creation fails with records_exist_at_subdomain if the parent zone already has records at or below that name.

/api/domains/:id/grants

GET/api/domains/:id/grants

List the access grants on a domain, each naming a member or group and its role.

POST/api/domains/:id/grants

Grant access. Body: subjectUserId or subjectGroupId, plus role (editor | manager). Re-granting the same subject updates the role.

DELETE/api/domains/:id/grants?grantId=

Revoke a grant. grantId is a required query parameter.

Grants require manager access and apply to the domain and every subzone below it — the highest role found on the domain or any ancestor wins. Editors manage records; managers can also create subzones, manage grants, and mint pinned tokens. Org owners and admins have full control everywhere without explicit grants.

/api/domains/:id/dnssec

GET/api/domains/:id/dnssec

Report whether DNSSEC is enabled, the zone's DS records, and whether the registrar chain is live.

POST/api/domains/:id/dnssec

Enable DNSSEC signing and return the DS records to place at the registrar. Requires owner or admin.

DELETE/api/domains/:id/dnssec

Disable DNSSEC signing and remove published DS records. Requires owner or admin.

For subzones the chain is fully automated: the DS set is published as managed records at the child label inside the parent zone. Root domains still need the DS records placed at the registrar by hand.